CVE-2025-43814

published 2025-09-22

CVE-2025-43814: In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA…

medium 6.9 CVSS 4.0

AV N AC L AT N PR H UI N VC H VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder answer, which allows remote authenticated users to obtain a user’s password reminder answer via the audit events.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	2023.Q3.1 – 2023.Q3.10	—
liferay	digital_experience_platform	>= 2023.Q4.0 < 2023.Q4.9	2023.Q4.9
liferay	dxp	2023.Q3.1 – 2023.Q3.10	—
liferay	dxp	2023.Q4.0 – 2023.Q4.8	—
liferay	dxp	7.4.13 – 7.4.13-u92	—
liferay	liferay_portal	>= 7.2.0 < 7.4.3.113	7.4.3.113
liferay	portal	7.4.0 – 7.4.3.112	—

CWE-201